IN THE FIRST DECADE OF THE 21ST CENTURY, WORLDWIDE, THE TREMENDOUS INCREASE IN THE AMOUNT OF AVAILABLE Information AND THE SPREADING OF THE ORGANIZATION WAS POSSIBLE THROUGH THE ENHANCEMENT OF THE ACCESS TO COMPUTERS AND TO INTERNET. A LACK OF Information Security AWARENESS WITHIN SOME PARTS OF SOCIETY AS WELL AS SOME Information SYSTEM CONTINUES TO EXIST TODAY. THIS PAPER PROVIDES GUIDELINES FOR BUILDING AND MAINTAINING A COMPREHENSIVE AWARENESS AND TRAINING PROGRAM, AS PART OF AN ORGANIZATION’S IT Security PROGRAM. THE GUIDANCE IS PRESENTED IN A LIFE-CYCLE APPROACH. THE DOCUMENT INCLUDES GUIDANCE ON HOW IT Security PROFESSIONALS CAN IDENTIFY AWARENESS AND TRAINING NEEDS, DEVELOP A TRAINING PLAN, THIS DOCUMENT ALSO DESCRIBES HOW TO: SELECT AWARENESS AND TRAINING TOPICS; IMPLEMENT AWARENESS AND TRAINING PROGRAM WITH SPECIAL METHODS; EVALUATE THE EFFECTIVENESS OF THE PROGRAM IN LINE WITH ORGANIZATIONAL CHANGE. OUR RESULTS INDICATE THAT THE CONSTRUCTS TECHNICAL KNOWLEDGE, ORGANIZATIONAL IMPACT CORRELATIONS WITH Information Security AWARENESS. INTERESTINGLY, ORGANIZATIONAL IMPACT GENERATED STRONGER ASSOCIATIONS WITH Information Security AWARENESS THAN TECHNICAL KNOWLEDGE.